About evsmt

evsmt · ‎06-12-2020

Check this app on splunkbase https://splunkbase.splunk.com/app/4182/ .

evsmt · ‎05-11-2018

You should use a summary index (http://docs.splunk.com/Documentation/Splunk/7.1.0/Knowledge/Usesummaryindexing) instead of an outputlookup. You could summarize stats of DNS resolving every 15 mins, and write this to the summary index. And than query the summary index to generate stats over a longer period.

evsmt · ‎04-20-2018

Yes, this method protects KO's shipped with the app. I do not know of an other method to achieve your goal.

evsmt · ‎04-20-2018

Define all Knowledge Objects that may not be deleted as .conf files in the /default directory in the app. This will only work if you know up front which KO may not be deleted. This will not protect against one user deleting a KO of another user which is shared in the app.

evsmt · ‎04-17-2018

Use mvexpand to create an event for each multi value value. You'll be able create a timechart with a line for each distict policy: my query | eval Policies=split(cat,";") | mvexpand Policies | timechart span=1h count by Policies

Posts	5
Solutions	1
Karma Given	6
Karma Received	1
Member Since	‎04-17-2018

Online Status	Offline
Date Last Visited	‎06-12-2020 08:45 AM

Re: Splunk - bitbucket Integration

Re: Building a passive dns lookup in Splunk (Large...

Re: How to add the permission to allow users to ch...

Re: How to add the permission to allow users to ch...

Re: How do I count unique values in a multi value ...